Fortigate IKE1 VPN and Apple iOS (with and without split tunnel)

[drixter]

Hi All,

I'm trying to setup:

Fortigate 40F v.7.2.11 as VPN IPSec server.

Apple iOS as VPN IPsec client, the built-in client.

I'm still trying to use IKE1 to do not go with certificates for now.

The problem what I see is:

• Whenever I'll enable Split tunnel and only expose specific networks (IPv4 works, IPv6 not) it's works.
  • On Windows with Forticlient both networks are working IPv4+IPv6, so IPv6 issues could be Apple centric case, not focusing right now.
• Whenever I'll disable Split tunnel and want that all traffic from iOS go thru Fortigate once VPN is UP the session do not come up.

Before I'll provide my technical setup, I just want to ensure, it is even possible to have such scenario that Split Tunnel will be disabled and all traffic will go over Fortigate (IPv4+IPv6, even only IPv4) using built-in Apple iOS VPN client?

Have anyone done that?

In theory it should be, because SSLVPN using Fortigate client on iOS (IPv4 only of course) is able to do so, but as SSLVPN is going away, I'm looking for alternative solution without any entra software and started wiping SSLVPN configuration.

My iOS is not MDM managed, I'm doing it for my private usage.

Thanks,

[kaman]

Hi Drixter,

If you use dialup vpn type on your firewall, you don't need to use FortiClient on iPad. You can configure ipsec on the settings menu.

Configure the iOS device.

1.In the iOS device, go to Settings > General > VPN and select Add VPN Configuration.
2.Set the Type to IPsec and enter a Description. Set the Server to the FortiGate's Internet-facing interface, and enter the username in Account. Enter the user password, the preshared IPsec VPN secret, then select Done.
3.Ensure that the IPsec VPN configuration is highlighted (indicated by a checkmark), and select the Not Connected button. The IPsec VPN connects with the user's credentials and secret. The status changes to Connected, and a VPN icon appears at the top of the screen.
4.Keep the default values for the Subnet Mask, DNS Server, and Enable IPv4 Split tunnel.

https://docs.fortinet.com/document/fortigate/7.4.3/administration-guide/311726/ios-device-as-dialup-...

If you have found a solution, please like and accept it to make it easily accessible to others.

Regards,
Aman

[drixter]

Hi Kaman,

Thanks for that but the main question is, will this work without "Split tunnel", so the all traffic will be routed over Fortigate?

Thanks,